How to `audit` `npm` `--global`?
Aug 25, 2:16pm

To audit globally installed npm packages on your system, you can use the npm audit command. This command checks for vulnerabilities in your project's dependencies (or globally installed packages) and provides a report of any issues found.

Steps to Audit Globally Installed npm Packages

1. Open a Terminal or Command Prompt

  • On Windows: Open Command Prompt or PowerShell.
  • On macOS/Linux: Open Terminal.

2. Run the Audit Command for Global Packages

Use the following command to audit globally installed packages:

bash
npm audit --global
  • This will scan all globally installed npm packages for known vulnerabilities.

3. Interpret the Results

  • The output will list vulnerabilities (if any) along with their severity (e.g., low, moderate, high, critical).
  • It will also provide suggestions for fixes, such as updating packages or applying patches.

4. Fix Vulnerabilities (Optional)

If vulnerabilities are found, you can attempt to fix them automatically by running:

bash
npm audit fix --global
  • This will try to update packages to versions that resolve the vulnerabilities.
  • If automatic fixes are not possible, you may need to manually update or remove vulnerable packages.

5. Check for Outdated Global Packages (Optional)

To ensure all global packages are up-to-date, run:

bash
npm outdated --global
  • This will list packages that have newer versions available.

Example Workflow

  1. Run npm audit --global to check for vulnerabilities.
  2. Review the report and decide if you want to apply fixes.
  3. Run npm audit fix --global to automatically fix vulnerabilities where possible.
  4. Manually update or remove packages if needed.
Aug 25, 2:16pm
On Linux Mint 22.3 Cinnamon I face:

```bash
npm audit --global
```
```
npm ERR! code EAUDITGLOBAL
npm ERR! `npm audit` does not support testing globals

npm ERR! A complete log of this run can be found in:
npm ERR! /home/benjamin_loison/.npm/_logs/2026-08-25T14_18_23_517Z-debug-0.log
```
Aug 25, 2:18pm

The error EAUDITGLOBAL with the message npm audit does not support testing globals means that, as of your version of npm, the npm audit command does not support auditing globally installed packages directly.

This is a known limitation in npm (as of certain versions, including npm v7 and later). The npm audit command is designed to work within a project directory (i.e., for local dependencies), not for globally installed packages.

Workarounds to Audit Global Packages

Option 1: Audit the Global Node Modules Directory Manually

You can manually audit the global node_modules directory by treating it like a local project.

  1. Navigate to the global node_modules directory:

    bash
    cd $(npm root --global)

  2. Run npm audit in that directory:

    bash
    npm audit
    • This will audit the packages installed in the global directory.

Option 2: Use npx to Run npm audit in the Global Directory

If you prefer not to cd into the directory, you can use npx to run npm audit directly in the global node_modules directory:

bash
npx npm audit --prefix $(npm root --global)
  • This forces npm audit to run in the global directory.

Option 3: Use pnpm or yarn (If Installed)

If you have pnpm or yarn installed, they support auditing global packages:

  • For pnpm:

    bash
    pnpm audit --global

  • For yarn:

    bash
    yarn audit --global

Option 4: Check for Vulnerabilities Using npm ls

You can list globally installed packages and manually check for known vulnerabilities using tools like npm-check or the Node Security Project (nsp) (deprecated, but alternatives exist).

  1. List global packages:

    bash
    npm ls --global --depth=0

  2. Manually check each package for vulnerabilities using:

    • Snyk (CLI tool for vulnerability scanning)
    • GitHub Advisory Database

Option 5: Update npm

Ensure you are using the latest version of npm, as newer versions may add support for global audits:

bash
npm install --global npm@latest

Then try npm audit --global again.

Summary

  • npm does not natively support npm audit --global in most versions.
  • Workaround: Run npm audit in the global node_modules directory using cd or npx.
  • Alternative: Use pnpm or yarn if available.
Aug 25, 2:18pm

This is a shared conversation and may include unverified content that doesn't reflect Mistral AI's views. Login to resume chatting.

Vibe can make mistakes. Check answers. Learn more